CVE-2026-82648 PUBLISHED

WWBN AVideo SSRF Filter Bypass via NAT64 Hex Address

Assigner: VulnCheck
Reserved: 30.08.2026 Published: 30.08.2026 Updated: 30.08.2026

WWBN AVideo contains a server-side request forgery filter bypass vulnerability in the isSSRFSafeURL function that fails to normalize NAT64 addresses written in hexadecimal form. Attackers can bypass SSRF protections by supplying hex-encoded NAT64 addresses like 64:ff9b::a9fe:a9fe to reach cloud metadata services and loopback interfaces.

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
CVSS Score: 7.1

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	High
Attack Complexity	High	Integrity	Low	Integrity	Low
Attack Requirements	Present	Availability	None	Availability	None
Privileges Required	Low
User Interaction	None

CVSS 4.0

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS Score: 7.1

Attack Vector	Network	Scope	Changed
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	Low
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	WWBN
Product	AVideo
Versions	Default: affected

CVE-2026-82648 PUBLISHED

WWBN AVideo SSRF Filter Bypass via NAT64 Hex Address

Metrics

Product Status

Credits

References

Problem Types